CAP Risk Management & Security Evaluation 2

Question 1

Which NIST publication provides the primary framework for federal information security risk management using the Risk Management Framework (RMF)?

Accepted Answer

NIST SP 800-37

Answer

NIST SP 800-37 defines the RMF and its six steps (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) for federal systems.

Question 2

During a security assessment, an assessor discovers that a control is partially implemented. How should this finding be recorded in the Security Assessment Report (SAR)?

Accepted Answer

As 'Other Than Satisfied' with documented weaknesses

Answer

A partially implemented control is recorded as 'Other Than Satisfied' in the SAR, with the specific weaknesses and deficiencies documented.

Question 3

What is the primary purpose of a Plan of Action and Milestones (POA&M)?

Accepted Answer

To document and track remediation of security weaknesses identified during assessment

Answer

A POA&M documents identified weaknesses, assigns responsibility, and establishes scheduled milestones for corrective action.

Question 4

Under FISMA, who is ultimately responsible for accepting the residual risk of operating a federal information system?

Accepted Answer

Authorizing Official (AO)

Answer

The Authorizing Official (AO) bears ultimate responsibility for accepting residual risk by signing the Authorization to Operate (ATO).

Question 5

Which risk response strategy involves transferring potential loss to a third party, such as through cyber insurance?

Accepted Answer

Risk Transference

Answer

Risk transference shifts financial or operational consequences of a risk to another party, such as an insurer or cloud service provider.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Risk Management & Security Evaluation 2